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Sir: 

Pursuant to Applicants' duty of disclosure under 37 C.F.R. §1.56, 
Applicant is not aware of any specific prior art which relates to computer 
security systems, computer-readable media, security software products, or 
computerized methods, as disclosed and claimed in the above-identified 
patent application. The Examiner's attention, however, is directed to the 
background discussion in the application as it relates to known aspects of 
operating system exploitations, qomputer forensics and operating system 
recovery. 

Information has also come to the attention of the Applicant pertaining to 
security products available from Guidance Software, Inc., a company 
headquartered in Pasadena, California. The enclosed information was obtained 
from the company's website at www.auidanc esoftware.com. More particularly, 
documentation is provided relating to at least two products referred to as the 



"EnCase Enterprise Edition" and the "EnCase Forensic Edition". Information is 
also provided pertaining to a component of at Enterprise Edition, referred to as 
the "EnCase Snapshot" . According to material from the website, the "Snapshot" 
utility can be used manually or automatically to capture and preserve volatile 
data on servers and workstations, in an effort to identify anomalous activity as 
part of best practices for incidence response and computer forensic 
examinations. 

It is not believed, however, that the Snapshot utility (or any other 
Guidance Software product for that matter) functions to locate a target memory 
range containing suspected data of interest, or actually search the short-term 
memory to locate such a target memory range. Moreover, Applicant also does 
not believe that these Guidance Software products are capable of copying data 
from volatile memory in a manner which avoids involving long-term memory 
resources, as contemplated and claimed in the present application. 

It is believed that the enclosed information and associated products from 
Guidance Software were not publicly available prior to the Fall of 2003. 
Applicant notes that information pertaining to EnCase version 4.16 bears a 
November 2003 notice, and it is believed that white papers may have been 
available in about September 2003. As such, while it appears the availability of 
this information pre-dates Applicant's earliest filing date, it does not pre-date 
Applicant's date of invention and, should the need arise, Applicant is prepared to 
submit an appropriate oath or declaration under 37 C.F.R. §1.131 to establish a 
prior date of invention of the subject matter of the claims for the present 
application. 



Accordingly, the identification of all of the above information is for the 
purpose of meeting Applicants 1 duty of disclosure under 37 C.F.R. Section 1.56 
and is not intended to be an admission that any of this information constitutes 
prior art as to the invention disclosed and claimed in the subject application. 
Applicant, thus, believes that this application presents new, useful and non- 
obvious technology and that the claims presented with this application are 
allowable. The Examiner is courteously solicited to enter an expeditious 
allowance of this application. If any questions remain to be addressed, it is 
respectfully requested that the undersigned attorney for the Applicant be 
contacted at the number listed below. 

Respectfully submitted, 
TIMOTHY J. MARTIN, RC. 



^^^^^^^^ 
Timothy J. Martin, #28,640 
Michael R. Henson, #39,222 
Rebecca A. Gegick, #51 ,724 
9250 W. 5th Avenue, Suite 200 
Lakewood, Colorado 80226 
(303) 232-3388 



CERTIFICATE OF MAILING UNDER 37 C.F.R. 1.8 

I hereby certify that the foregoing TRANSMITTAL OF INFORMATION 
DISCLOSURE (3 pages) AND FORM PTO/SB/08 (1 page) is being deposited 
with the United States Postal Service as first-class mail in an envelope 
addressed to Mail Stop DD, Commissioner for Patents, P.O. Box 1450, 
Alexandria, VA 22313-1450, on this day of June, 2004. 
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